Intelligence

The Court of Appeal has upheld a decision finding that an employer was not responsible as a data controller for personal data stored on a work device. The case arose from a 2021 HSE cyberattack where an employee's personal accounts and cryptocurrency were compromised on his work phone. The ruling clarifies the scope of data protection complaints and the extent of regulatory investigation obligations.

How is the Irish Data Protection Commission responding to unprecedented complaint volumes driven by AI-generated submissions? What are the most common mistakes controllers make when handling subject access requests, and why is transparency becoming a critical enforcement focus?

The European Court of Justice's Advocate General has delivered an opinion suggesting that the proportionality of data retention regimes should be assessed not only by the categories of data retained, but also by the technical arrangements surrounding that retention. This opinion raises questions about whether Ireland's 2022 Communications (Retention of Data) (Amendment) Act provides sufficiently...

Ireland's Data Protection Commission received a record 16,160 new cases in 2025, marking a 45% increase from the previous year, while imposing over €530 million in administrative fines. The Commission finalized four major inquiries, with the TikTok decision accounting for €530 million of the total penalties, and concluded 208 cross-border complaints as Lead Supervisory Authority.

The Central Bank of Ireland’s (CBI) consultation on its Regulatory Impact Assessments and Approach to Consultation closes for feedback on 30 September 2026.

The Irish High Court has clarified the scope of statutory exemptions under the Data Protection Act 2018, ruling that organisations can legitimately refuse data subject access requests when legal privilege, client confidentiality, or litigation interests are at stake. This landmark decision establishes clear boundaries between different exemption provisions and confirms their compatibility with GDPR Article 23, providing much-needed guidance for organisations navigating complex disclosure obligations.